Kedro's _get_versioned_path() method in versions before 1.3.0 constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because these version strings are used as path components, traversal sequences such as '../' are preserved, enabling path traversal attacks. This vulnerability is reachable through multiple interfaces including catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI command kedro run --load-versions=dataset:../../../secrets. An attacker able to influence the version string can force Kedro to access files outside the intended directory, potentially exposing sensitive data or enabling data poisoning. The issue is resolved in version 1.3.0.

Successful exploitation allows an attacker with the ability to influence version strings to read unauthorized files outside the intended dataset directory. This can result in exposure of sensitive information, data poisoning, or unauthorized cross-tenant data access in shared environments. The CVSS score of 7.1 reflects high confidentiality impact with limited integrity impact and no availability impact.

This vulnerability is fixed in Kedro version 1.3.0. Users should upgrade to version 1.3.0 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Until upgraded, avoid passing untrusted input as version strings to the affected methods and CLI options.